LDAP Authentication on OpenBSD

Question

I'm trying to get an OpenBSD server to authenticate users using the same LDAP server the rest of my home network uses. While 'getent password' lists the users from the LDAP server as expected, I cannot log in as any of them.

I have following n my /etc/login.conf:

#
# ldap
#
ldap:\
        :auth=-ldap:\
        :x-ldap-server=kaitain.cory.albrecht.name,389,plain:\
        :x-ldap-basedn=ou=People,dc=cory,dc=albrecht,dc=name:\
        :x-ldap-filter=(&(objectclass=posixAccount)(uid=%u)):\
        :tc=default:

But when I try to test a user, I get the following:

root@opensecrets:/etc# /usr/libexec/auth/login_-ldap -d -s login cory ldap
Password: 
load_ssl_certs says:
        cacert none
        cacertdir none
        usercert none
        userkey none
parse_server_line buf = host
parse_server_line port == NULL, will use default
parse_server_line mode == NULL, will use default
host host, port 389, version 3
setting cert info
clearing ssl set
ldap_open(host, 389) failed
host failed, trying alternates
ldap_open failed
reject

That plus these lines from the log

Dec 17 15:30:19 <auth.warn> opensecrets.cory.albrecht.name opensecrets login_ldap: ldap_open(host, 389) failed
Dec 17 15:30:19 <auth.warn> opensecrets.cory.albrecht.name opensecrets login_ldap: ldap_open failed

make me think some how /etc/login.conf's ldap section is not being read. Changing the 389 for the port to 38389 in login.conf makes no change to the output of the faked/testing login.

I'm completely stumped as to what to do to determine what is causing login.conf to not be fully parsed and I'm kind of hoping it's something easy at which I will be terribly embarrassed for forgetting it.

Answer 1

It turns out that virtually all web pages out there the walk you through installing login_ldap, ypldap and ypind to do this leave out one thing. Because /etc/login.conf is a termcap-formatted file, you need to do 'cap_mkdb login.conf' for the login_ldap routines to actually see your configuration in the resulting /etc/login.conf.db file. This is different from other programs which use the termcap format but do not need it compiled into a database file, such as rtadvd.

The only webpage that includes this step is this one from Talmasca (link now dead), whereas nearly every other walk-through appears to be derived from this one at Helion Prime (link now dead) which does not mention that you need to use cap_mkdb.